HARDWARE HEURISTIC-DRIVEN BINARY TRANSLATION-BASED EXECUTION ANALYSIS FOR RETURN-ORIENTED PROGRAMMING MALWARE DETECTION

摘要

A combination of hardware monitoring and binary translation software allow detection of return-oriented programming (ROP) exploits with low overhead and low false positive rates. Embodiments may use various forms of hardware to detect ROP exploits and indicate the presence of an anomaly to a device driver, which may collect data and pass the indication of the anomaly to the binary translation software to instrument the application code and determine whether an ROP exploit has been detected. Upon detection of the ROP exploit, the binary translation software may indicate the ROP exploit to an anti-malware software, which may take further remedial action as desired.

主权项

1. A machine readable medium, on which are stored instructions, comprising instructions that when executed cause a programmable device to:
configure a processor of the programmable device to detect code flow anomalies; receive an indication of a code flow anomaly from the processor; perform binary translation of a portion of an application corresponding to the code flow anomaly; and detect a return-oriented programming exploit responsive to the binary translation.